Los Angeles court ransomware attack closes courthouses

Analyst assessment

A ransomware attack disrupted the Los Angeles County Superior Court beginning July 19, 2024. The court’s initial statement confirmed the attack and said staff disabled network systems to contain it. Officials believed the incident was unrelated to the faulty CrowdStrike update occurring that day. The reviewed evidence establishes ransomware and operational disruption, but does not identify the operator or initial access method.

Operational significance

The court’s July 19 revised notice documented unavailable call centers, impaired electronic filing and postponed proceedings. Urgent filers were directed to clerk’s offices in person; other filings were deferred. This revised notice superseded an earlier assertion that electronic filing remained available.

A July 21 release and closure order described inaccessible court-data platforms, telephone systems and internal case-management systems. All 36 courthouses closed July 22. Filing deadlines and specified proceedings received one-day extensions. This was a countywide court-system interruption; it does not establish compromise of Los Angeles County government’s separate computer systems.

The court reopened July 23 with limited functionality. Its July 24 update reported restored jury-registration and telephone reporting instructions, plus remote access for civil, juvenile, criminal and appellate matters. Remote appearances in family law, probate and traffic cases remained unavailable. Affected parties were directed to appear in person where possible, with continuances for matters that could not proceed.

In its July 25 service-status update, the court showed its attorney portal still unavailable while all 36 courthouses and clerk’s offices were open, jury reporting was operating and court proceedings were moving forward.

The disruption reached other courts through Los Angeles-hosted telephone infrastructure. Associated Press reporting published by SecurityWeek identified Shasta, Inyo, San Luis Obispo, Stanislaus and Colusa counties. Shasta’s court executive described unavailable phones, fax and text reminders on July 24 while cases continued normally. A Stanislaus court notice independently confirmed its telephone outage and directed users to email and online services. These are downstream service effects, not proof that each court’s own network was separately compromised.

Recovery and confidence

On July 29, the court announced that all public-facing and internal network systems had been restored that morning, including document access, remote appearances, jury registration, traffic payments and electronic filing. That statement establishes July 29 as the restoration date for the primary court’s systems. The reviewed sources do not establish a separate exact restoration time for every dependent court’s telephone service.

Analytic gaps

The July 19 preliminary investigation found no evidence of compromised court-user data. The July 29 notice still described investigation of possible data compromise as ongoing. Neither statement establishes a final finding that no information was accessed or stolen. The reviewed evidence does not substantiate a specific encryption mechanism, data theft, a ransom demand or payment, or an identified responsible group.

July 19 is supported as the reported attack and disruption start, first public service warning and public ransomware disclosure. July 25 is the latest directly reviewed dated observation of ongoing operational impairment; July 29 is the confirmed restoration date. No precise time of initial intrusion is established. Later unrelated court outages do not extend this incident.